@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by unknown CVE via @apollo/composition (>=2.3.0, <=2.9.4)

@apollo/composition NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: unknown CVE Source advisory: OSV:GHSA-M8JR-FXQX-8XX6...

GHSA-GRX8-G27P-8HPP

creationtimestamp| type| source ---|---|--- 2025-11-13 17:55:59+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115543674662995941...

GHSA-QWVM-X4XH-G2QQ

creationtimestamp| type| source ---|---|--- 2025-11-13 16:05:46+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115543241220528720...

CVE-2025-64517

sudo-rs is a memory safe implementation of sudo and su written in Rust. With Defaults targetpw or Defaults rootpw enabled, the password of the target account or root account instead of the invoking user is used for authentication. sudo-rs starting in version 0.2.5 and prior to version 0.2.10...

GHSA-6FHJ-VR9J-G45R vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-4WHC-3XQP-JPRR vulnerabilities

Vulnerabilities for packages: binutils...

GHSA-W337-WPHV-G4VH vulnerabilities

Vulnerabilities for packages: binutils...

GHSA-77MM-F2XG-RWG2 vulnerabilities

Vulnerabilities for packages: binutils...

GHSA-39HR-239P-FHQC

creationtimestamp| type| source ---|---|--- 2025-11-12 19:13:20+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115538316443414289...

Malicious code in react-icons-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 224e1d5b1a2b01321da822c843e2013f28320e4b9d4d74487daef59c812557f6 The package react-icons-toolkit was found to contain malicious code. Source: ghsa-malware...

GHSA-M6HQ-P25P-FFR2 vulnerabilities

Vulnerabilities for packages: buildkitd, manifest-tool, k9s, helm, rancher-fleet, docker-cli-buildx, k3s, helm-push, kargo, kubescape-operator, newrelic-infrastructure-agent, zarf, helm-set-status, syft, envoy-gateway, headlamp, xeol, fuse-overlayfs-snapshotter, kaniko, falco-no-driver,...

GHSA-PWHC-RPQ9-4C8W vulnerabilities

Vulnerabilities for packages: grype, helm-push, k3s, kubescape-operator, cloudbeat, gitlab-operator, gogatekeeper, kubevela, consul-k8s-fips, nerdctl-fips, opa-envoy, k8sgpt, flux-source-controller, cert-manager-cmctl, chartmuseum-fips, trivy-operator-fips, gitlab-rails-ce-fips,...

Fedora 42 : python-starlette (2025-4520cf6bac)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-4520cf6bac advisory. Backport security fix for CVE-2025-62727, GHSA-7f5h-v6xp-fcq8 Tenable has extracted the preceding description block directly from the Fedora security advisor...

Fedora 41 : python-starlette (2025-10d2e6260b)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-10d2e6260b advisory. Backport security fix for CVE-2025-62727, GHSA-7f5h-v6xp-fcq8 Tenable has extracted the preceding description block directly from the Fedora security advisor...

GHSA-2QFP-Q593-8484 vulnerabilities

Vulnerabilities for packages: mitmproxy...

GHSA-PWHC-RPQ9-4C8W

creationtimestamp| type| source ---|---|--- 2025-11-06 18:58:31+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115504284375786423...

GHSA-CGRX-MC8F-2PRM

creationtimestamp| type| source ---|---|--- 2025-11-05 14:59:52+00:00| seen| https://mstdn.social/users/jschauma/statuses/115497683553103053 2025-11-06 20:51:33+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115504728778207295...

GHSA-4575-FH42-7848

creationtimestamp| type| source ---|---|--- 2025-11-04 23:39:54+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115494066188195772...

GHSA-5JPX-9HW9-2FX4 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu...

Fedora 41 : openapi-python-client / python-uv-build / ruff / etc (2025-43a0bff5ea)

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-43a0bff5ea advisory. uv 0.9.5 https://github.com/astral-sh/uv/blob/0.9.5/CHANGELOG.md Since uv was built with astral-tokio-tar 0.5.6, this is a security fix for...